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The security proofs of continuous-variable quantum key distribution are based on the assumptions that the 
eavesdropper can neither act on the local oscillator nor control Bob's beam splitter These assumptions may be 
invalid in practice due to potential imperfections in the implementations of such protocols. In this paper, we 
consider the problem of transmitting the local oscillator in a public channel and propose a wavelength attack 
which can allow the eavesdropper to control the intensity transmission of Bob's beam splitter by switching 
the wavelength of the input light. Specifically we target continuous-variable quantum key distribution systems 
that use the heterodyne detection protocol using either direct or reverse reconciliation. Our attack is proved 
to be feasible and renders all of the final key shared between the legitimate parties insecure, even if they have 
monitored the intensity of the local oscillator. To prevent our attack on commercial systems, a simple wavelength 
filter should be added before performing the monitoring detection. 
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I. INTRODUCTION 

Quantum key distribution (QKD) enables two distant part- 
ners, Alice and Bob, to share common secret keys in the pres- 
ence of an eavesdropper. Eve lll|2|]. In theory, the uncondi- 
tional security of QKD protocol is guaranteed based on the 
laws of physics, in particular the no-cloning theorem. But in 
practice, the key components of practical QKD systems have 
imperfections that do not fulfill the assumptions of ideal de- 
vices in theoretical security proofs. In discrete-variable QKD, 
the imperfect devices such as single photon detectors, phase 
modulators, Faraday mirrors and fiber beam splitters, open se- 
curity loopholes to Eve and lead to various types of attacks 

a. 

Continuous-variable (CV) QKD IT^ has developed im- 
mensely over the past decade lfT6ll to the point that there 
are companies selling commercially available systems IitI 
[isll . Even so, CV-QKD is potentially vulnerable to such 
idealization-to-practical problems that plague its discrete vari- 
able counterpart. In the CV-QKD protocols, Alice encodes the 
key information onto the quadratures, X and P, on a bunch of 
coherent states and sends them onto Bob. Bob measures one 
or both quadratures by performing homodyne [.19,1 or hetero- 
dyne detection [20] on the signal with a relatively strong local 
oscillator (LO). Finally, they perform direct or reverse recon- 
ciliation andprivacy amplification process to distill a common 
secret key llllllltl. In practice, it is extremely difficult for Bob 
to generate the LO with the same initial polarization and phase 
to Alice's signal. Therefore, Alice prepares both the signal 
and LO, and send them to Bob in the same optical fiber chan- 
nel at the same time to avoid the large drifts of the relative 
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polarization and phase 112111 . However, this implementation 
leaves a security loophole open for Eve. 

In Ref. [,22j[ . the authors proposed an equal-amplitude at- 
tack. To perform this attack. Eve first intercepts the signal 
and LO, and measures both of the quadratures by performing 
heterodyne detection on them. According to her measurement 
results, she reproduces two weak squeezed states which have 
the same intensity level to the signal, and sends them onto 
Bob. Bob treats these two fake states as signal and LO, and 
performs detections on them as usual. But now the detection 
is neither homodyne nor heterodyne detection, therefore Eve 
is able to make the extra noise of Bob's measurement much 
lower than the shot noise level. As a result, the total deviation 
between Bob's measurement and Alice's preparation is lower 
than the tolerable threshold derived from the theoretical secu- 
rity proofs [|23[ l24l[ . Hence Alice and Bob can not discover 
the presence of Eve. 

In order to prevent this attack without modifying the origi- 
nal measurement setup. Bob needs to monitor the total inten- 
sity or the LO intensity [22]. We note that in this attack. Eve is 
assumed to be unable to control the beam splitters of Bob. But 
in one of our recent studies [T?!, we found that it is possible 
for Eve to control the outputs of fiber beam splitters by utiliz- 
ing its wavelength dependent property [25M27||. Importantly, 
such wavelength dependent properties can be found in com- 
mercial CV-QKD systems lUTlllal . Making use of this loop- 
hole, we propose a new wavelength attack on a practical CV- 
QKD system using heterodyne detection protocol [20,]. By 
using this attack Eve can in principle achieve all of the secret 
key without being discovered, even if Bob has monitored the 
total intensity or the LO intensity. Such an attack has practical 
and commercial consequences. 

In the security analysis of CV-QKD protocols with direct 
(reverse) reconciliation, V^|_b(Vb|^), Alice (Bob)'s condi- 
tional variance of Bob (Alice), has the similar status as the 
quantum bit error rate (QBER) in the discrete-variable QKD 
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protocols. To show that the hidden Eve would not be discov- 
ered in our attack, our method is proving that the upper bound 
of Va\b (Vb\a) under our wavelength attack is always lower 
than the maximum value allowed by the secret key rate for- 
mula [20,21]. 

This paper is organized as follows. In Section|II] we first re- 
view the heterodyne protocol and the wavelength-dependent 
property of certain fiber beam splitters, then we propose a 
wavelength attack scheme on an all-fiber CV-QKD system us- 
ing heterodyne protocol in Section|llI] We prove the feasibility 
of this wavelength attack in Section HVl and finally conclude 
in SectionlV] 



and the photon number n are related hy i = qh = qa)d, where 
a and a) are the annihilation and creation operators of the light 
state, and q is a suitable constant j2f^. The extra quantum 
noise Soiy is unavoidable in Bob's measurement results when 
he uses heterodyne detection due to the unused port of the 
50 : 50 beam splitter. To show this, let us first describe the 
signal and LO by operators and Alo. respectively. These 
operators can be broken up into two contributions IBOll : the 
mean values of the amplitude a as well as the quantum noise 
fluctuations 5a. The operators can be written as 

As = Q!s + 5as, 

O-LO = CtLO + SaLO- 



II. PRELIMINARY 

A. Heterodyne detection protocol 

In the heterodyne protocol [20,1 , Alice first prepares a dis- 
placed vacuum state that will be sent to Bob. This is realized 
by choosing two real numbers Xa and Pa from a Gaussian 
distribution of variance Va and zero mean. The whole ensem- 
ble of coherent states Alice will send to Bob is given by the 
thermal state with variance V = Va + 1- Bob receives this 
coherent state and simultaneously measures both the ampli- 
tude and phase quadratures of the state using heterodyne de- 
tection. After repeating this process many times, they finally 
extract a binary secret key by using either direct reconcilia- 
tion [28] or reverse reconciliation algorithm \3M- A typical 
CV-QKD system using heterodyne protocol can be realized 
by the schematic shown in Fig. [T] In this scheme, time and 
polarization multiplexing are used so that the signal and LO 
can be transmitted in the same channel without interfering. 
To avoid the equal-amplitude attack ll22ll . Bob uses a 1 : 99 
beam splitter(not depicted in the figure) behind the polariza- 
tion beam splitter to monitor the LO intensity. 
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FIG. 1 : The schematic diagram of heterodyne detection protocol. 
BSa: 1/99 beam splitter; BSb: 50/50 beam splitter; PM: phase mod- 
ulator; AM: amplitude modulator; PBS: polarization beam splitter; 
PC: polarization controller. Alice generates coherent light pulses by 
a 1550 nm laser diode, then separates them into a weak signal and a 
strong LO by a 1 /99 beam splitter. The signal is then modulated ran- 
domly following the centered Gaussian distribution in both quadra- 
tures, by using phase and amplitude modulators. The signal and LO 
are separated in time and modulated into orthogonal polarizations by 
the PBS before begin inserted into the channel. 

To perform the heterodyne detection. Bob uses the photo- 
detector to convert the photons into a photocurrent i. Here i 



where ag and a lq ^"e complex numbers and we assume that 
the amplitude of the LO is much larger than the signal, i.e., 
\ciLo\ ^ l^sl, and Sets and S&lo are the fluctuations of the 
signal and LO, respectively. 

The photocurrents read by the four photo-detectors can be 
written as follows 
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Here we have absorbed the vacuum noise terms Say into the 
terms Sa' . For simplicity, let us assume that a^o is a real 
number. To derive the quadratures X and P, the difference of 
the two photocurrents should be measured 
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where X = as + al and P = —i{as — a^) are the exact 
quadratures that Bob wants to measure, SX' = {Sets + Sal) + 
{Say +Sal) = SX + SXy and SP' = -i{Sas - S&l) - 
i{Say—Sal) = SP+SPy are the quantum noises entering into 
Bob's measurement. Several terms have been neglected above 
according to the fact that \aLo\ ^ l^sl- SX and SP satisfy 
the canonical commutation relation [SX,SP] = 2i, therefore 
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the Heisenberg uncertainty relation {{5X)'^){{SP)'^) 
derivable [22]. 

Under the condition that Eve cannot act on the LO (a com- 
mon assumption in the security proofs [T]), it is only when the 
excess noise reaches two times the shot-noise level that Eve 
can perform an intercept-resend attack on the channel llsill . 
It is due to the fact that Eve will introduce vacuum noise by 
using heterodyne detection and consequently, suffer the quan- 
tum fluctuations when she reproduces the signal state in a sim- 
ple intercept-resend attack. 



B. Wavelength-dependent fiber beam splitter 



In Ref. ||13|] . we studied the wavelength-dependent prop- 
erty of the fiber beam splitter which is made by the fused 
biconical taper technology ll25ll . The fused biconical taper 
beam splitter is made by closing two or more bare optical 
fibers, fusing them in a high temperature environment and 
drawing their two ends at the same time. Subsequently, a 
specific biconic tapered waveguide structure can be formed 
in the heating area. The fused biconical taper beam split- 
ter is widely use in the fiber QKD systems because of the 
feature of low insertion loss, good directivity and low cost. 
However, intensity transmission of the fused biconical ta- 
per beam splitter is wavelength-dependent, and most types 
of fused biconical taper beam splitters work only in a lim- 
ited range of wavelengths (limited bandwidths), where the 
intensity transmission of the beam splitter can be defined as 

T = Iportl / (Iportl + Iport2), wherC Iportl (Iport2) is OUtpUt 

light intensity from beam splitter's output port 1 (2). Typical 
coupling ratio at the center wavelength provides optimal per- 
formance, but the intensity transmission varies periodically 
with wavelength changes. The relationship between wave- 
length A and the intensity transmission T by using the cou- 
pling model is given in Ref. |26, 27]: 



T ^F^ sin^ 



^T(A). 



(4) 



where is the fraction of power coupled, C ■ A^/^ is the 
coupling coefficient, and w is the heat source width. 



III. WAVELENGTH ATTACK ON A CV-QKD SYSTEM 
USING HETERODYNE PROTOCOL 



The basic idea of the wavelength attack is shown in Fig. |2] 
Eve intercepts the coherent states sent by Alice. She makes 
heterodyne measurement of the signal using the LO to achieve 
the quadrature values Xe and Pe- After that. Eve gener- 
ates and re-sends two coherent states: a fake signal state 
\a'g) and a fake LO state \a'j^o)- Different from the previous 
intercept-resend attack, these two fake states have different 
wavelengthes, denoted as Ai (for \a'^)) and A2 (for la^^)). 
According to Eq. (|4|i, the performance of Bob's beam splitter 
is dependent on the wavelength of the incoming light. There- 
fore the fake signal with wavelength Ai, the transmission 
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FIG. 2: The schematic diagram of the wavelength attack scheme. 
WT-LD: the wavelength tunable laser diode; IM: the intensity mod- 
ulator; BS: 50/50 beam splitter. The WT-LD and IM are used in pro- 
ducing fake coherent states with the specific wavelength and ampli- 
tude set by the controller. The red (dotted) beam splitters are the ones 
controlled by Eve. The red beam splitter on the left has transmission 
Ti, while the red beam splitter down the bottom has transmission T2. 



of Bob's beam splitter is determined by the function T(Ai) 
which is defined in Eq. (|4|i. Similarly, the intensity transmis- 
sion of Bob's beam splitter to the fake LO state is determined 
by T(A2). In other words. Eve can control Bob's beam splitter 
by tuning the wavelength of her fake states. 

With the help of the wavelength tunable laser diodes and 
intensity modulators, the wavelength and amplitude of these 
fake states are carefully chosen to satisfy the following condi- 
tions 
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where Ti = r(Ai) G [0,1], = T(A2) G [0,1], = 
T'(A2) £ [0, 1]. Here rj is the channel transmission efficiency, 
\as\ and |q;lo| are the amplitudes of the original signal and 
the LO, respectively, [a'^l and are the amplitudes of the 

fake signal and the fake LO, is the intensity transmissions 
of Bob's 1 : 99 beam splitter (for monitoring the LO light 
intensity) when the fake LO enters it. Condition (i) ensures 
the total intensity is unchanged and condition (ii) makes sure 
the method of monitoring the LO intensity is also invalid to 
Eve. Here we assume that Bob uses a 1 : 99 beam split- 
ter to split the LO light. Because the 1:99 beam splitter is 
also wavelength-dependent if it is made by the fused biconi- 
cal taper technology, its intensity transmission can be deter- 
mined by a function similar to Eq. which is denoted by 
T'{X)o^F'^sm\ ^'^"jy ). 

As Bob measures the quadratures Xb and by perform- 
ing heterodyne detection on the fake signal and the fake LO, 
conditions (iii) and (iv) make Bob's measurement results co- 
incide with the ones attained by Eve. To see explicitly where 
these relations come from, see Eqs. (IA5b and (IA6t in the Ap- 
pendix. Notice that the fake signal and the fake LO have dif- 
ferent wavelengths, and hence, no interference occurs in this 
detection. The effect of this on the measurement detection 
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is that we no longer have heterodyne detection outputs but 
rather outputs that are proportional to Eve's measurements. 
Therefore, the photocurrents recorded by the photo-detectors 
consist of parts from the signal and the LO. We are going to 
prove in Section |IV] that the extra noise introduced by Bob's 
measurement is much lower than the shot-noise level, there- 
fore the total noise can be kept under the alarm threshold. In 
other words. Eve can safely achieve the key information with- 
out being discovered by Alice or Bob. 

Finally, we note that if there were no limits to Ti, T2 
and T2, i.e., {Ti,T2,T2} G (—00,00), the four parameters 
Ai, A2, la^l ™d Wlo\ sufficient to achieve conditions (i)- 
(iv). But as we must require T € [0, 1], we note that con- 
ditions (iii) and (iv) may not always be satisfied. However, 
by numerical simulation we find that the probability of failing 
condition (iii) or (iv) is extremely close to zero thanks to the 
fact that |aLOp 3> Ve- To explain this let's look at an ex- 
ample. Let us assume that Alice chooses |aLoP = 10* and 
V = 11 and the parameters of Eq. (|4) are taken from lUsll . To 
make our conclusion more convincing, we narrow the range of 
Ti and T2 to be [0.1, 0.9], and restrict both and |a'^oP 
to be larger than 10"^. The simulation result shows that condi- 
tions (iii) and (iv) can always be satisfied if \Xe\, \Pe\ < 50. 
Notice that the distribution of Xe and Pe is a Gaussian distri- 
bution with variance of Ve — Va, it is easy to derive that the 
probability of I > 50 or IPs] > 50 equals erfc(^) ~ 0, 

where erfc(x) = ^ e~^^ dx is the error integral function. 

Moreover, Eve can do even better by adding more wave- 
lengths to the fake states. For example, the fake signal and 
fake LO can both be composed of two coherent states and in 
such a case Eve becomes more powerful because she has more 
control. By using the same method in Section lTV Bl the feasi- 
biUty of this modified scheme can also be proved. 



IV. FEASIBILITY ANALYSIS 

To analyze the feasible of the wavelength attack, we first 
note that the following assumptions should be satisfied: 

(1) This attack is restricted to an all-fiber coherent-state CV- 
QKD using heterodyne protocol. 

(2) All of Bob's beam splitters have the same wavelength 
dependent property, i.e., their intensity transmissions are all 
determined by Eq.dHi with the same parameters. This func- 
tion and the detection efficiencies of Bob's detectors are both 
known by Eve. Here we assume that the detection efficiencies 
are wavelength independent for simplicity. In practice. Eve 
can simply absorb the differences into the light amplitudes 
modulated by her and the final results are unchanged. 

(3) Eve has the ability to replace the quantum channel with 
a noiseless fiber, and her detectors have high efficiency and 
negligible excess noise. 

In the heterodyne protocol, the lower bound of the secret 
key rates for Heisenberg-limited individual attack in direct 
reconciliation and reverse reconciliation are given, respec- 



tively, by m 



K^^ > log 



{i + x)[i + v{v + x)] 

2 {1 + xv)[i + v{i + x)y 

V + yjl + xV) 

Tjii+xv)[i+v{i+x)y 



(6) 



(7) 



where x = (1 — r/)/// + e is the total added noise referred to 
the input, (1 — »7)/?7 stands for the loss-induced vacuum noise, 
e is the excess noise above the shot noise level. Note that 
we use the 'Heisenberg-limited attack' rather than the optimal 
attack ll24l I32I1 as such an attack upper bounds Eve's infor- 
mation thereby emphasizing our wavelength attack which can 
even beat such a stringent attack. To make the secret key rate 
positive, we require that 



A ^ A.max 



1 - 1 
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with I < 77 < 1 for direct reconciliation or 



A ^ /\max 



^{^ + 1)V^-2V + 



1-V -1 



(8) 



(9) 



with < 77 < 1 for reverse reconciliation, should be satisfied. 

Another important parameter in the security proof is Alice' s 
(Bob's) conditional variance of Bob's (Alice's) measurement 
(^b|a) in direct reconciliation (reverse reconciliation), 
which can be thought of as the uncertainty in Alice's (Bob's) 
estimates of Bob's (Alice's) quadrature measurement result. 
In the CV-QKD, Alice and Bob use Va\b (Vb| 4) to estimate 
the shot noise and modulation imperfections l'21'l. Va\b is 
defined (where both quadratures are symmetrized) as 



Va\b = Va 



and similarly, we have Vb\a defined as 



V, 



B\A 



T/„ {XaXb) 



(10) 



(11) 



We now proceed to consider the conditional variance values 
for the two cases: the usual eavesdropping attack and a wave- 
length attack. 



A. Eve's Typical Attack 

Even in typical eavesdropping attack, Va\b is at the 

shot noise level because of the vacuum noises introduced by 
Alice's modulation, the channel loss and Bob's heterodyne 
measurement. The evolution of the quadrature value, with 
channel noise, from a real value Xa chosen by Alice to the 
measurement result Xb achieved by Bob is listed as follows 
(we write down the quadrature X only since the other quadra- 
ture P can be presented in the similar way) 



Xa -^Xa = Xa + Na 

Xb' = ^Xa + VT^Xn 

-^XB = ^i^XA + V^ 

= j={^XA + VvNA + V^ 



tjXn 



Nb) 
7^Xn+Nb): 



(12) 
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where Xjv is the quadrature of the inserted vacuum state due 
to channel loss, and Nb is the vacuum noise introduced by the 
heterodyne detection. 



1. VV 



in direct reconciliation 



In direct reconciliation, Alice's conditional variance of 
Bob's measurement in the absence of Eve, which we will de- 
note as V^°™'^\ can be calculated as follows 



T/normal 



(v-i)h(x+i)+i] 



(13) 



where Vn = {^n) variance of the channel noise, which 
can be related to x by Vn — VX/ ~ v)- Combining Eq. ( fT3] l 
with Eq. we can find that for the sake of deriving a positive 
secret key rate, the upper bound of y^Kg™"' yields 



1/max 



_ (V-l)(V4i)^ + l+2»)+l) 
^Jilf + l+2T|V+l 



(14) 



In other words, if Va\b is smaller than this threshold, the het- 
erodyne protocol in direct reconciliation is considered to be 
secure. Hence we prove our attack feasible by showing that 



Eve can make V, 



A\B 



< 



wavelength attack. 



^A\B 



when she is performing the 



where Ne represents the vacuum noise in Eve's heterodyne 
detection, whose variance is normalized to 1. The variance 
of each of the terms is given by: Ve — ■^{V + 1) and 
Vb = tiVe + Vnb- Here Vnb can then be considered as 
Eve's conditional variance of Bob's measurement result. In 
Appendix IaI we derive the value of Vnb and show that it is 
smaller than 10^^ri{V + 1). For practical purposes, let us set 
V = 11, therefore Vnb 
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1. v: 



A\B 



in direct reconciliation 



According to the definition of Va\b in Eq. (fTol i. the value 



of y^fn"'^'"' can be computed as follows 



'a\b 



V. 



attack 



A\B 



2VNB+r,{V+l) 



(18) 



Combining with Eq. ( |A9l l and the discussions above, we can 
estimate that the value of V^^^'^'^ is not larger than 2.1. As 
shown in Fig. [3] (where we set y = 11 and e = 0.01 ||24ll ), 
yat^ck always lower than V^"^^, so that Alice and Bob can 
never discover the eavesdropper under this attack. Besides, 
one should notice that V^^^'^'^ is always lower than the normal 
level, therefore Eve should increase the deviations on purpose 
to make V^^^'^''' close to vj^°™°-^ in order to avoid suspicion. 



2. 1/^ 



in reverse reconciliation 



In reverse reconciliation, Alice's conditional variance of 
Bob's measurement in the absence of Eve, which we denote 
as y^*!"^™"', can be calculated as follows 



ynormal = 1 [^(1+ ^) + 1] . 



(15) 



Combining with Eq. (|9|l, the upper bound of v^"™"''' is de- 



rived to be 



^B\A 



(16) 



In other words, if Vbi^ is smaller than this threshold, the het- 
erodyne protocol in reverse reconciliation is considered to be 
secure. Hence we prove our attack feasible by showing that 
Eve can make Vb\a < ^sfl^ when she is performing the 
wavelength attack. 



B. Eve's Wavelength Attack 




Channel loss(dB) 



FIG. 3: In direct reconciliation, the relation between the channel loss 
and the conditional variance V^i^ in three cases: (a) the maximum 
tolerable value V^'S' . (b) the value of V^m""''^ and (c) the value 



of VX"b'"'''- See main text for details. 



experimentally realistic values, V 



The curves are plotted for 
11 and e = 0.01. We can see 



that V^Ib"'" is always lower than VXIb'' and lower than l/Xi"^™"' 
when the channel loss is larger than 0.4 dB at which point the key 
between Alice and Bob is no longer secure. 



When Eve performs the wavelength attack, the evolution of 
the quadratures from Xa to Xb are written as follows 



Xa ^ Xa = Xa + Na 
1 



Ne) 

^ Xb = ^/vXe + Nb, 



In reverse reconciliation, using Eq. (fill with Eq. (|T7t , the 



(1"^) value of yg*^'"^'^ can be computed as 

v^l'/^'^ ^v + VNB- 
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Combining with Eq. (|A9l l and the discussions above, we can 
estimate that the value of V^*^"^*^ is never larger than lArj. 
As shown in Fig. |4] (where again we have set = 11 and 
e = 0.01), it is always lower than the value of V^"^^ so that 
Alice and Bob can never discover the eavesdropper under such 
an attack. Besides, one should notice that V^*^'"^'^ is lower 

than the V^°^'^°''^ when the channel loss is larger than 0.41 dB. 
Hence, Eve should increase the deviations to make V"^*^"^*^ 
close to V^^™""^ in order to avoid suspicions. 




Channel loss(dB) 



FIG. 4: In reverse reconciliation, the relation between the channel 
loss and the conditional variance Vb\a in three cases: (a) the max- 
imum tolerable value V^IT ■ (b) the value of V^fJ^™"' and (c) the 
value of l/g*^"'^*'. See main text for details. The curves are plotted 
for experimentally realistic values, V = 11 and e = 0.01. We can 
see that Vg"/"'' is always lower than VS\T and lower than VS°X""''^ 
when the channel loss is greater than 0.4 dB, again leading to an in- 
secure key. 



states. The feasibility analysis for this kind of attack is simi- 
lar to the one we have derived in Section IIV Bl One can still 
use Eqs. ( fTSl ) and ( fT9l ) but the value of Vj^b should be re- 
estimated. For the four-wavelength scheme which is depicted 
at the end of Section |llll one can easily find that the result 
Vnb ^ Yo holds, therefore the conclusions in Section ITVB II 
and Section ITV B 2l remain the same. 

Finally, we note that a commercial CV-QKD system, as 
sold by iITtIi . currently uses a wavelength-dependent beam 
splitter Although, it does not fall into the regime studied 
in this paper because it uses homodyne detection rather than 
heterodyne detection. However, our results show that if one 
were going to use heterodyne detection with a commercial 
QKD unit, then the precautions mentioned here would need 
to be taken. Furthermore, possible quantum hacking oppor- 
tunities with homodyne detection and wavelength-dependent 
beam splitters warrant further investigation. 

In conclusion, we have proposed a new type of realistic 
quantum hacking attack, namely the wavelength attack, on 
continuous-variable QKD systems using heterodyne detec- 
tion. If Alice and Bob don't take the necessary precautions for 
such an attack, the final secret key is in principle, totally inse- 
cure as Eve can obtain all the information about the final key. 
This is different from the equal-amplitude attack proposed in 
Ref. ll22ll as in the wavelength attack. Eve has the ability to 
control Bob's beam splitter and therefore the suggestion of 
testing the total intensity in Ref. [22] would not prevent such 
an attack from occurring. To close such a loophole in prac- 
tical CV-QKD systems, it is simply enough for Bob to add a 
wavelength filter before his detection. 
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Eve should add extra noise on her measurement result to 
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As we have discussed in Section Hill Eve can do better 
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Appendix A: Derivation of Vnb 

To derive Vnb, let us start from the generation of Eve's fake 
states. As we have described in Section [Till Eve generates 
the fake signal state and the fake LO state according to her 
measurement results and sends them to Bob. These fake states 
can be described by the following operators 

a', = a; + 

Where complex numbers a'g and a'^Q are the amplitudes and 
(5a'j, and 5a'j^Q represent the fluctuations of the amplitudes as 
discussed in Section UlAl Similarly, {{SX'^f) = {{SPlf) = 
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1, where SXk = + ba^, and bP\^ = —i{5a'p. — 5a^), k = 
s, LO. 

Bob performs heterodyne detection on these fake states. 
According to Eq. dU, Bob's beam spHtter has different inten- 
sity transmissions for a'^ and because of their different 
wavelengths, denoted as Ti and T2. After passing the first set 
of beam sphtters, a'^ is separated into ai and a^, while d^Q is 
separated into 0:2 and 0.4 (cf. Fig.|2]i, which can be expressed 
as follows 

di = ^/l - Tia'g + ^/T\5ayi, 

where ia^i, 60,^2 are the vacuum noises that interfere with 
the fake signal and the fake LO, respectively, at Bob's beam 
splitter To simplify the symbols, let us define 5a'i = 



S a'^ = V T[Sa'^ - VI - Tid&yi and 6a'^ = y/%Sa'^Q - 
-y/l — T'2(5d^2- Furthermore, we define the quadratures of Sa'j, 
by SXk = Sa'f. + <5dJ and 5Pk = — z((5d'j. — (5dJ) where 
k = 1, 2, 3, 4. Finally, after combining at the second set of 
beam splitters, the electromagnetic fields arrive at the four de- 
tectors can be written as 

bi = \/l - Ti&i + \/72'd2, 

62 = y/TiOii - \/l - T'2d2, ^^^y^ 

63 = yr^^Tida + VTjd4, 
bi = y/Pias — \/l — T2ai. 

where the photocurrents are given by ifc = qb\^k- Bob's 
quadrature measurement results are then derived from the dif- 
ference in photocurrents, using the method in Section III AI 
Firstly, for detectors Dl and D2, we have 



«1 - «2 
q{b\bi - 



blb2) 



q[{l - 2Ti)[(l - ri)|a'j2 + V]~7Y(a';5di + a'^Sa'l) + 6a\5ai 



+ V(i-r i)r2[v/(r 



T2K 



-V(i-r2)ri[y(T 

+ (2T2-1)[(1- 



T2)(a-tf 



LO 



d^) + Jd'/f^dj + 6a'i6a2] 

^o) + VT^i{a':5a'2 



(A4) 



Ti)(l-T2)K*a' 



LO 



T2(Q:^Q(5d'j^ + a^^Qd']^) + (5d7^d2 + <5d']^^d' 



T2)Wlo? + yr^(a'£o<5d^ + ai.o'5«?) + 5a\5a2] 



Note that d'^Q and 6/^ have different frequencies, therefore any terms not containing the product of the same frequencies vanish 
during the measurement. The remaining terms compose the measurement result of ix 



ix =q[(l-ri)(l 

+(i-T2)(2r2 



(1 - 2ri)Vl -Ti(a'/(5di + a'^Sa'l) 
l)\a'^o? + (2^2 - l)VT^2{a'lo5a'2 + «'io<5d^^)]. 



2ri)|a; 



(A5) 



Similarly, we get the measurement result of ip as: 

ip = is 



H = qiblh - blbi) 
= <j[Ti(l - 2Ti)|<|2 + (1 - 2Ti)V7YK*'5d^ + a'Ja'^) 
+ T2(2T2 - + (2T2 - l)VT^{a'loSa', + a^o<5dJ) 



(A6) 



Notice that the squared modulus terms in the last two equations are what helped us derive the set of conditions in Eq. (|5]l. The 
measurement results corresponding to Bob's quadratures Xb and Pb are then calculated using Eq. (O: 



Xr = 



Pb = 



^ 2[ri-"ri)(l-2Ti)|<|^ + (l-T2)(2T2-l)|a^ol"] 

\aLo\ 

, 2[{l-2Ti)./l^{a';S&[+a'Ja[^) + {2T2-l)VT^{a'^oS&i,+a'^oS&'^)] 

^ \aLo\ 
= \fnXE + Xnb^ 



(A7) 



9|atol 

2[Ti(l-2Ti)|a'j''+T2(2T2-l)|a^o|^] 

2[(l-2Ti)v/7T(a"^a3+a;^&3^) + (2T2-l)v/7i'(a2'o<5a4+a'^o,5aJ)] 



V^Pl; + Pl 



|aio| 



8 



where we have used conditions (iii) and (iv) from Eq. (|5). Let a'j^Q and a'^ be real, we then get the following inequalities: 



j> ^ 2[(l-2Ti)v/T^(a;i5a;+Q;i5a;t) + (2T2-l)v/I^(a'^o^a^+«'^ote^t)] 

\aLo\ 



< 



P, 



NB 



\aLo\ 

2[(l-Ti)(l-2Ti)af jX; + (l-T2)(2T2-l)ago^X^] ^ 1 

2[Ti(1^2Ti)(a'^ja;,+a;^a;,t)+r2(2T2-l)(a^0^a;;+a'^oaa;t)] 
|aiol 

2[Ti(l-2Ti)a',^ +T2(2r2-l)ag,- i 



(A8) 



^ 2[Ti(l~2Ti)af gX,;+T2(2T2-l)agoa^^] i 



where = min(|a'j2 Ja'^^p), 7;^^^^ ^ niax(Ti,r2), 

Tmin = iniii(ri,T2) and 6X[ = Sa'i + Sa'i and similai^ 
to SX2-i- Therefore, 

Vnb,. - {{Xnb)') < • max((5i;2), (JX^^)) 

_ r)(V+l) 
~ a^(l-T„ax) ' 

(A9) 



Finally, we need to estimate the size of Vnb- Using 
the restrictions and simulation results we discussed in Sec- 
tion [nil the worst strategy for Eve is choosing = 
min(K|Ma'^o|2) = lO^, T,,i„ = 0.1 and T^,^ = 0.9. 
Then ^ii^^,^^^^^) = ^5^— = 10"^. Hence we get Vnb < 
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